Rack is a popular interface for developing web applications in Ruby. Recently, an important security vulnerability (CVE-2025-27610) was discovered in versions prior to 2.2.13, 3..14, and 3.1.12 of Rack, specifically in the Rack::Static component. This vulnerability allows attackers to exploit insufficiently sanitized user-supplied paths and potentially access sensitive files outside the designated static file directory. This post will discuss the details of the vulnerability, provide a code snippet for better understanding, and offer important links for mitigating the vulnerability and patching affected systems.

Vulnerability Details

The issue arises with the Rack::Static component, which is responsible for serving static files under a specified root: directory. Unfortunately, even if specific urls: are provided, the vulnerable versions of Rack::Static can inadvertently expose other files under the root: directory. This occurs because the component does not properly sanitize user-supplied paths, allowing attackers to bypass the initial security measures by encoding path traversal sequences.

Exploit Details

An attacker can exploit this vulnerability by determining the path of the target file, and encoding it with path traversal sequences. By doing this, they can effectively bypass the security measures and access all files under the specified root: directory.

Here's a simple code snippet illustrating this vulnerability

# Vulnerable versions of Rack
require 'rack/static'

use Rack::Static, 
    :urls => ["/public"], 
    :root => "/var/www"

In this example, the /public directory is intended to serve public files, and the /var/www directory contains sensitive files. The issue occurs whenever an attacker provides a path traversal sequence such as /public/../sensitive_file - the Rack::Static component does not properly sanitize this input, allowing the attacker to access /var/www/sensitive_file.

Mitigation Steps

The vulnerability has been fixed in versions 2.2.13, 3..14, and 3.1.12 of Rack. It is strongly recommended that users upgrade to the latest version or patch their systems. Patching information can be found in the original reference GitHub Advisory.

Removing the usage of Rack::Static entirely.

2. Ensuring the root: directory points to a path containing only files intended to be accessed publicly.

Conclusion

This vulnerability highlights the importance of regularly updating software packages and verifying the security of web applications. If you are using Rack and may be affected by CVE-2025-27610, please consult the original references and ensure your systems are appropriately patched.

Original References

- GitHub Advisory
- Rack Official Repository

Timeline

Published on: 03/10/2025 23:15:35 UTC